Exploit / PoCcritical
IT threat evolution in Q2 2016. Overview
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2015-2545 | Malformed EPS Image RCE in Microsoft Office | — | 86% | KEV | — KEV |
| CVE-2016-0147 | Microsoft XML Core Services 3.0 allows remote attackers to execute arbitrary code via a crafted web site, aka "MSXML 3.0 Remote Code Execution Vulnerability." | 8.8 | 16% | ||
| CVE-2016-1010 | Integer Overflow RCE in Adobe Flash Player and AIR | 8.8 | 19% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | partner.xdedic.biz | rm for others. The XDedic forum has a separate sub-domain, ‘partner[.]xdedic[.]biz’, for the site’s ‘partners’ – that is, those selling ha |
| domain | xdedic.biz | bridgehead for further targeted attacks. The owners of the ‘xdedic[.]biz’ domain claim that they have no relation to those selling |
From the original article
14 min read at securelist.com
Earlier in the year, as part of an incident response investigation, we uncovered a new version of the Skimer ATM malware. The malware, which first surfaced in 2009, has been re-designed. So too have the tactics of the cybercriminals using it.
By @Securelist · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.